BaFin German Financial Brief
Headline
BaFin imposes €240,000 fine on TeamViewer SE for delayed ad hoc disclosure of a cyberattack
Executive Summary
BaFin fined TeamViewer SE €240,000 on July 16, 2026, for failing to disclose a cyberattack as inside information under the Market Abuse Regulation's ad hoc disclosure requirement. BaFin concluded the attack was price-sensitive and required immediate public disclosure. The company did not meet that obligation.
Bottom Line
BaFin's July 16, 2026 fine establishes an on-record enforcement instance in which a cyberattack against a German-listed software company is treated as inside information triggering the ad hoc disclosure obligation under the Market Abuse Regulation. The €240,000 penalty reflects a finding that TeamViewer SE failed to publish that information as soon as possible. The maximum statutory fine for this violation is €2.5 million or 2% of total annual revenue. Cresthaven reading: German-listed issuers in technology and software sectors face the clearest exposure under this precedent, as BaFin's reasoning explicitly ties the inside-information classification to the issuer's sector.
Key Regulatory Signals
- Cyberattack Classified as Inside Information: BaFin determined that the cyberattack against TeamViewer SE constituted inside information under the Market Abuse Regulation, with BaFin noting the classification was reinforced by TeamViewer SE's status as a software company. German-listed issuers that experience material cybersecurity incidents face the same disclosure standard.
- Ad Hoc Disclosure Obligation Applies to German-Listed Issuers: BaFin confirmed that companies based in Germany that issue securities traded on an organized market in Germany are subject to the requirement to publish inside information as soon as possible. Cresthaven reading: issuers in this category that have not mapped cybersecurity incident response to their ad hoc disclosure procedures carry a gap this enforcement action puts in direct focus.
- Fine Ceiling Stated by BaFin: BaFin states the maximum administrative fine for failure to comply with the ad hoc disclosure obligation is €2.5 million or up to 2% of total annual revenue. The €240,000 fine imposed on TeamViewer SE sits below that ceiling.
- Dual Rationale for Prompt Disclosure: BaFin articulates two grounds for the disclosure requirement: preventing insiders from gaining a trading advantage through privileged access, and ensuring investors are not misled when making investment decisions. Both rationales apply equally to any inside information, not only cyberattack disclosures.
Regulatory Delta
- No prior BaFin enforcement action specifically fining a named German-listed issuer for failing to disclose a cyberattack as inside information has been publicly identified.
- The enforcement treats a cyberattack as inside information subject to the existing ad hoc disclosure requirement, with BaFin citing TeamViewer SE's status as a software company.
- The European Securities and Markets Authority has addressed ad hoc disclosure obligations under the Market Abuse Regulation through supervisory convergence work. This BaFin action aligns with the broader EU emphasis on timely issuer disclosure of material non-public events.
Materiality Classification
MEDIUM — A single-firm enforcement action that introduces an explicit on-record BaFin precedent classifying a cyberattack as inside information triggering ad hoc disclosure obligations, carrying a sector signal relevant to German-listed technology and software issuers beyond the named respondent.
Intelligence Outlook
Monitor BaFin for further enforcement actions applying this disclosure theory to cybersecurity incidents at other German-listed issuers, and for any published guidance on the ad hoc disclosure standard as applied to material cyber events.